TCP:S vs TCP:FA
-
@erbalo said in TCP:S vs TCP:FA:
after resetting states again.
Why are you resetting states.. There is almost never reason to do that.. If your creating a rule and need, just reset the state for the IPs in question of that new rule. And only time you have to reset state on a new rules, is in the case where traffic already there that would match your rule.. Say you want to block port X.. And device A was talking to something already on port X.. You might want to kill that specific state, vs waiting for that session to end or time out so the rule would block new traffic to that port.
IPS dropping shit is not in your firewall log. You would need to look into IPS to why its dropping stuff. If the firewall dropped the packet, it would of never made it to the ips to even look at.
-
@erbalo Can you please advice me to where tick or untick on these settings as your advice. It is now clear by me that these logs what i am seeing there are out of states logs and i don't really to see that, it filling my logs only with full of entries.
-
Oh my gawd... You need to see them because there is something wrong! Why are you resetting states?
We already went over how not to see them..
-
If it is something wrong i have no idea how i can solve this problem. I have followed your advice and NOT already reset the states.
-
So your not resetting states... And your still seeing a constant flood of this traffic?
If so then you have something MAJOR wrong with your network setup... Please draw out how you have this network connected together and were your clients are pointing to for their gateways.
If you are seeing constant traffic like this - this points to asymmetrical routing problem.. Not logging it doesn't fix the problem.
-
@johnpoz
Yes, i am seeing constant flood.Pfsense is installed on hyper vm.
Internal Realtek netwerk adapter used for Wan and connectesnmodem on this port and on pfsense used as Gateway.
External realtek netwerk adapter used for Lan and connected to netgear switch and created vlans and also the trunk port 1. Vlans are working. Also on hyperv via powershell created vlans to accept all of the vlans.
Clients are points to that Gateway, i have one gateway.
-
That sure doesn't look like a drawing to me..
That looks like words that don't really help... Since there is no details at all..
So you have 1 nic that is connect to your modem but then
this port and on pfsense used as Gateway.
How is pfsense your wan gateway??? That makes ZERO sense!!
External realtek netwerk adapter used for Lan and connected to netgear switch and created vlans and also the trunk port 1.
So now you have another adapter.. But you allow all vlans on this?? How many vlans? What netgear switch?
What gateway are you clients pointing to - they should be pointing to the IP of pfsense for their specific vlans - since you have stated you them?
Lets see the output of your hyper-v setup... Got to love how no mention of any VM or anything until now...
What networks are these vlans using - for all we know, since you hid the rfc1918 space.. The firewall is blocking IPs that are not even suppose to be in the iot vlan, etc..
Love to help be we have zero idea what sort of mess you have configured..
-
This post is deleted! -
Why do you have all your vlans on both interfaces in hyperv? Only network that should be on wan is the wan network..
-
@johnpoz said in TCP:S vs TCP:FA:
Why do you have all your vlans on both interfaces in hyperv? Only network that should be on wan is the wan network..
Corrected the Interfaces:
